@_mustachio/openauth 0.9.2 → 0.11.0

package/src/http/handlers/method-route.ts

@@ -0,0 +1,115 @@
+/**
+ * `GET|POST /m/:methodId/*` — the credential-flow dispatch endpoint.
+ *
+ * Methods that need POST routes (`password` `/login`, `code` `/send`+`/verify`,
+ * `passkey` `/authenticate-options` etc.) declare them on
+ * `AuthMethod.routes`. The HTTP layer mounts those routes here. The
+ * `domain/method-route.handleMethodRoute` orchestrator handles flow lookup
+ * + dispatch + result translation.
+ */
+import { handleMethodRoute } from "../../domain/method-route"
+import { authError } from "../../types/error"
+import { isErr } from "../../types/result"
+
+import { applyResponsePolicy } from "../cookies"
+import type { HttpContext, HttpDeps } from "../context"
+import { authorizeDirectErrorResponse } from "../errors"
+
+export function makeMethodRouteHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
+    if (!tenant) {
+      return authorizeDirectErrorResponse(
+        authError.invalidRequest("tenant unresolved"),
+      )
+    }
+    const cookies = c.get("cookies")
+    const flowId = cookies.get("idp.flow")
+    if (!flowId) {
+      return authorizeDirectErrorResponse(
+        authError.invalidRequest("missing flow cookie", "flow"),
+      )
+    }
+
+    // /m/<methodId>/<subPath>
+    const url = new URL(c.req.url)
+    const segments = url.pathname.split("/").filter(Boolean)
+    if (segments.length < 3 || segments[0] !== "m") {
+      return authorizeDirectErrorResponse(
+        authError.invalidRequest("malformed method route", "path"),
+      )
+    }
+    const methodId = segments[1]!
+    const subPath = "/" + segments.slice(2).join("/")
+    const httpMethod = c.req.method.toUpperCase() === "POST" ? "POST" : "GET"
+
+    const result = await handleMethodRoute(
+      {
+        rawRequest: c.req.raw,
+        tenant,
+        methodId,
+        subPath,
+        httpMethod,
+        flowId,
+        cookies,
+      },
+      {
+        sessionStore: deps.sessionStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
+        methodCache: deps.methodCache,
+        clock: deps.clock,
+      },
+    )
+
+    if (isErr(result)) return authorizeDirectErrorResponse(result.error)
+
+    const out = result.value
+    switch (out.kind) {
+      case "issue-code": {
+        const redirect = new URL(out.appRedirectUri)
+        redirect.searchParams.set("code", out.code)
+        if (out.appState !== null)
+          redirect.searchParams.set("state", out.appState)
+        return applyResponsePolicy(
+          new Response(null, {
+            status: 302,
+            headers: { location: redirect.toString() },
+          }),
+          {
+            setCookies: [clearFlowCookie()],
+            cookieDefaults: deps.cookieDefaults,
+          },
+        )
+      }
+      case "challenge":
+        return applyResponsePolicy(out.response, {
+          setCookies: out.setCookies,
+          cookieDefaults: deps.cookieDefaults,
+        })
+      case "denied":
+        return applyResponsePolicy(
+          new Response(`access_denied: ${out.reason}`, {
+            status: 403,
+            headers: { "content-type": "text/plain" },
+          }),
+          {
+            setCookies: [clearFlowCookie(), ...out.setCookies],
+            cookieDefaults: deps.cookieDefaults,
+          },
+        )
+    }
+  }
+}
+
+function clearFlowCookie() {
+  return {
+    name: "idp.flow",
+    value: null,
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax" as const,
+    maxAge: 0,
+  }
+}

package/src/http/handlers/par.ts

@@ -0,0 +1,84 @@
+/**
+ * `POST /par` — Pushed Authorization Requests (RFC 9126 §2).
+ *
+ * Body: `application/x-www-form-urlencoded` carrying the same parameter
+ * set the RP would otherwise put on `GET /authorize`, plus `client_id`
+ * and optionally `client_secret`. Client credentials may alternatively
+ * ride in `Authorization: Basic` (RFC 6749 §2.3.1).
+ *
+ * Response: HTTP 201, JSON `{request_uri, expires_in}` on success.
+ */
+import { resolveClientCredentials } from "../../domain/client-auth"
+import { pushAuthorizationRequest } from "../../domain/par"
+import { authError } from "../../types/error"
+import { isErr } from "../../types/result"
+
+import type { HttpContext, HttpDeps } from "../context"
+import { tokenEndpointErrorResponse } from "../errors"
+import { parBodySchema } from "../schemas/par"
+
+export function makeParHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
+    if (!tenant) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest("tenant unresolved"),
+      )
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase()
+    if (!ct.startsWith("application/x-www-form-urlencoded")) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          "body must be application/x-www-form-urlencoded",
+        ),
+      )
+    }
+    const raw = Object.fromEntries(
+      new URLSearchParams(await c.req.raw.text()).entries(),
+    )
+    const parsed = parBodySchema.safeParse(raw)
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          parsed.error.issues[0]?.message ?? "invalid request",
+        ),
+      )
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret,
+    })
+    const clientId = creds?.clientId ?? parsed.data.client_id
+
+    // Strip auth-only fields from the param record we persist — they
+    // belong to `/par`, not to the rehydrated `/authorize` request.
+    const { client_secret: _strip, ...paramsForAuthorize } = parsed.data
+    void _strip
+
+    const res = await pushAuthorizationRequest(
+      {
+        clientId,
+        ...(creds?.clientSecret !== undefined
+          ? { clientSecret: creds.clientSecret }
+          : {}),
+        params: paramsForAuthorize,
+      },
+      tenant,
+      {
+        configStore: deps.configStore,
+        sessionStore: deps.sessionStore,
+        ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
+        clock: deps.clock,
+      },
+    )
+    if (isErr(res)) return tokenEndpointErrorResponse(res.error)
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+      },
+    })
+  }
+}

package/src/http/handlers/register.ts

@@ -0,0 +1,70 @@
+/**
+ * `POST /register` — RFC 7591 Dynamic Client Registration.
+ *
+ * Body: `application/json`. Tenant resolved via the standard middleware.
+ * The framework validates structure here and defers persistence to the
+ * `IdPOptions.registerClient` hook (in `domain/register.ts`).
+ *
+ * Per RFC 7591 §3.2.1, success returns HTTP 201 with JSON body.
+ */
+import { registerNewClient } from "../../domain/register"
+import { authError } from "../../types/error"
+import type { RegisterClientRequest } from "../../types/idp"
+import { isErr } from "../../types/result"
+
+import type { HttpContext, HttpDeps } from "../context"
+import { tokenEndpointErrorResponse } from "../errors"
+import { registerBodySchema } from "../schemas/register"
+
+export function makeRegisterHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
+    if (!tenant) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest("tenant unresolved"),
+      )
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase()
+    if (!ct.startsWith("application/json")) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest("body must be application/json"),
+      )
+    }
+    let raw: unknown
+    try {
+      raw = await c.req.raw.json()
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e)
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(`malformed JSON: ${reason}`),
+      )
+    }
+    const parsed = registerBodySchema.safeParse(raw)
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          parsed.error.issues[0]?.message ?? "invalid request",
+        ),
+      )
+    }
+    // Schema is `.passthrough()` (RFC 7591 allows extension metadata
+    // fields); the declared `RegisterClientRequest` fields are all
+    // statically present in `parsed.data`. This cast just drops the
+    // passthrough's `[k: string]: unknown` index signature so the
+    // downstream domain function sees the typed contract.
+    const request = parsed.data as RegisterClientRequest
+
+    const res = await registerNewClient(request, tenant, {
+      ...(deps.registerClient ? { registerClient: deps.registerClient } : {}),
+      clock: deps.clock,
+    })
+    if (isErr(res)) return tokenEndpointErrorResponse(res.error)
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+      },
+    })
+  }
+}

package/src/http/handlers/revocation.ts

@@ -0,0 +1,151 @@
+/**
+ * RFC 7009 `/revoke` and RFC 7662 `/introspect` HTTP shims.
+ *
+ * Both accept `application/x-www-form-urlencoded`. Client credentials
+ * may ride in the form body (`client_id`, `client_secret`) or in an
+ * `Authorization: Basic` header (RFC 6749 §2.3.1); the header wins when
+ * both are present.
+ *
+ * Revoke: anonymous calls are permitted for tokens issued to public
+ * clients (RFC 7009 §2.1). Confidential-client tokens require auth.
+ *
+ * Introspect: client auth is REQUIRED (RFC 7662 §2.1). Anonymous calls
+ * are rejected at this layer with `invalid_client`.
+ */
+import { resolveClientCredentials } from "../../domain/client-auth"
+import { introspect } from "../../domain/introspect"
+import { revokeToken } from "../../domain/revoke"
+import { authError } from "../../types/error"
+import { isErr } from "../../types/result"
+
+import type { HttpContext, HttpDeps } from "../context"
+import { tokenEndpointErrorResponse } from "../errors"
+import { injectResolverHints } from "../resolver"
+import { introspectBodySchema, revokeBodySchema } from "../schemas/revocation"
+
+export function makeRevokeHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const body = await readForm(c.req.raw)
+    if (!body) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          "body must be application/x-www-form-urlencoded",
+        ),
+      )
+    }
+    const parsed = revokeBodySchema.safeParse(
+      Object.fromEntries(body.entries()),
+    )
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid"),
+      )
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret,
+    })
+    const res = await revokeToken(
+      {
+        token: parsed.data.token,
+        ...(parsed.data.token_type_hint
+          ? { tokenTypeHint: parsed.data.token_type_hint }
+          : {}),
+        ...(creds ? { clientId: creds.clientId } : {}),
+        ...(creds?.clientSecret !== undefined
+          ? { clientSecret: creds.clientSecret }
+          : {}),
+      },
+      {
+        tokenStore: deps.tokenStore,
+        configStore: deps.configStore,
+        ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
+        clock: deps.clock,
+      },
+    )
+    if (isErr(res)) return tokenEndpointErrorResponse(res.error)
+    // RFC 7009 §2.2: success returns 200 with empty body.
+    return new Response(null, {
+      status: 200,
+      headers: { "cache-control": "no-store" },
+    })
+  }
+}
+
+export function makeIntrospectHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const body = await readForm(c.req.raw)
+    if (!body) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          "body must be application/x-www-form-urlencoded",
+        ),
+      )
+    }
+    const parsed = introspectBodySchema.safeParse(
+      Object.fromEntries(body.entries()),
+    )
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid"),
+      )
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret,
+    })
+    if (!creds) {
+      // RFC 7662 §2.1 — endpoint MUST require some form of auth.
+      return tokenEndpointErrorResponse(
+        authError.invalidClient("introspection requires client authentication"),
+      )
+    }
+    // Resolve the presenter's tenant from the request the same way the
+    // m2m grant does — by injecting client_id into the URL so a
+    // canonical search-param resolver works for introspect too.
+    const tenantRes = await deps.resolveTenant(
+      injectResolverHints(c.req.raw, { client_id: creds.clientId }),
+    )
+    if (isErr(tenantRes)) {
+      return tokenEndpointErrorResponse(
+        authError.invalidClient(`unknown client "${creds.clientId}"`),
+      )
+    }
+    const res = await introspect(
+      {
+        token: parsed.data.token,
+        ...(parsed.data.token_type_hint
+          ? { tokenTypeHint: parsed.data.token_type_hint }
+          : {}),
+        clientId: creds.clientId,
+        ...(creds.clientSecret !== undefined
+          ? { clientSecret: creds.clientSecret }
+          : {}),
+        presenterTenantId: tenantRes.value,
+      },
+      {
+        keyStore: deps.keyStore,
+        configStore: deps.configStore,
+        issuerUrl: c.get("issuerUrl"),
+      },
+    )
+    if (isErr(res)) return tokenEndpointErrorResponse(res.error)
+    return new Response(JSON.stringify(res.value), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+      },
+    })
+  }
+}
+
+async function readForm(req: Request): Promise<URLSearchParams | null> {
+  const ct = req.headers.get("content-type") ?? ""
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return null
+  }
+  return new URLSearchParams(await req.text())
+}